![](bg2.png)
IoT end nodes, with high detection rate and low false
alarms.
(Doohwan-Oh, 2014) presents a lightweight se-
curity system that uses a novel malicious pattern-
matching engine. The authors manage to limit the
memory usage of the proposed system in order to
make it work on resource-constrained devices. To
mitigate performance degradation due to limitations
of computation power and memory, the authors pro-
pose two novel techniques, auxiliary shifting and
early decision.
(T-H-Lee, 2014) proposes a lightweight intrusion
detection model based on analysis of node’s energy
consumed in a 6LowPAN network. The 6LoW-
PAN energy consumption models for mesh-under and
route-over routing schemes are created. The sensor
nodes with irregular energy consumption are identi-
fied as malicious attackers.
(Summerville, 2015) have developed an ultra-
lightweight deep packet anomaly detection approach
that is feasible to run on resource constrained IoT de-
vices, but still provides good discrimination between
normal and abnormal payloads. Due to its simplicity,
the approach can be efficiently implemented in either
hardware or software and can be deployed in network
appliances, interfaces, or in the protocol stack of a de-
vice.
(Pongle, 2015) propose a novel intrusion detec-
tion system for the IoT, which can detect a wormhole
attack and the attacker. The proposed methods use
the location information of node and neighbour infor-
mation to identify the wormhole attack and received
signal strength to identify attacker nodes.
(Anhtuan-Le, 2016) propose a specification to de-
tect Routing Protocol for Low power and Lossy net-
work (RPL) topology attacks that can downgrade the
network performance significantly by disrupting the
optimal routing structure.
(Rathore, 2018) introduce a fog-based attack de-
tection framework that relies on the fog computing
paradigm and a newly proposed ELM-based Semi-
supervised Fuzzy C-Means (ESFCM) method. As an
extension of cloud computing, fog computing enables
attack detection at the network edge and supports dis-
tributed attack detection.
(Chawla, 2018) propose a platform intrusion de-
tection system that uses machine learning algorithms
to detect security anomalies in IoT networks. This
detection platform provides security as a service and
facilitates inter-operability between various network
communication protocols used in IoT.
(A-A-Diro, 2018) propose design and implemen-
tation of deep learning based distributed attack detec-
tion mechanism, which reflects the underlying dis-
tribution features of IoT. Moreover, (Maniriho and
Ahmad, 2018) also studies the Performance of Ma-
chine Learning Algorithms in Anomaly Network In-
trusion Detection System. Furthermore, other re-
search works propose various detection techniques in-
cluding Probabilistic-driven Ensemble Approach pro-
posed by (Saia et al., 2018), and IDS with Internet-
integrated CoAP Sensing Applications proposed by
(Granjal and Pedroso, 2018).
In general, there is a lot of research work
that addresses various Intrusion Detection Sys-
tem approaches reaching from rule-based detection,
anomaly-based detection, to machine learning and
deep learning. However, to the best of our knowl-
edge, none of them address specific techniques to de-
tect attacks on large-scale ZigBee IoT system under
its various constraints.
3 IoT ZigBee SECURITY
3.1 ZigBee Protocol
This section describes the ZigBee stack architecture
(ZigBee-Alliance, 2015) and network topology de-
fined in the ZigBee standard specification provided by
ZigBee Alliance.
3.1.1 ZigBee Stack Architecture
As described in ZigBee Specification (ZigBee-
Alliance, 2015), the ZigBee Alliance has developed
a very low-cost, very low power consumption, wire-
less communications standard. Solutions adopting the
ZigBee standard are embedded in consumer electron-
ics, home and building automation, industrial con-
trols, medical sensor applications, toys, and games.
The ZigBee stack architecture is defined based on
a set of layers. Each layer performs a specific set of
services for the layer above and below. Figure 1 rep-
resents the outline of the ZigBee Stack Architecture.
Basically, ZigBee Stack Architecture is built based
on two standards. The lower layers, which are the
Physical Layer (PHY) and the Medium Access Con-
trol (MAC) are defined by IEEE 802.15.4 standard.
The upper layers, which are Network Layer (NWK)
and Application Layer (APL) are defined by ZigBee
Alliance itself. Furthermore, ZigBee also offers net-
work layer and application layer security.
ZigBee PHY uses three different frequency
ranges. The lower frequency band 868 MHz is used in
Europe and 915 MHz band is used in several countries
such as United Stated and Australia. Furthermore, the
higher frequency band in 2.4 GHz is used worldwide.
IoTBDS 2020 - 5th International Conference on Internet of Things, Big Data and Security
58